USN, section of internationalization, will process personal data in order to facilitate international student exchange.
The lawfulness of the processing is to make student exchange contracts possible, and the public interest of safe student exchanges with partner institutions. In addition, some students are asked to sign separate student promotion contracts (not detailed here).
The data falls in these categories: name, student number, contact information, duration and place of stay, information about next-of-kin, academic results. The “Learning agreement” contain the student name, as well as the name of the contact person at the home and partner institution. In some cases a letter of motivation is written by the student and submitted to the partner institution. Students should limit the personal information given in such a letter, and if they provide any special categories information, like health information, they should consent to sharing this information with the partner institution. Further, sometimes letters of reference, academic results etc. may be shared with the partner institution.
Such partner institutions may be European, or in countries where the Commission has decided that the level of protection is adequate. In that case the GDPR allows the flow of such data. Where personal data must be transferred to other states, the lawfulness of the transfer will be based on the EU-Commission standard contractual clauses.
Certain personal data for Erasmus-purposes are store done year at the most, while other data will be stored according the information specified in the information documents for archiving and for FS (the student administrative system of USN). Students may see their own application etc. in the “Studentweb”.
If you have any questions, please contact Eline Flesjø Eline.Flesjo@usn.no or Ingebjørg Synnøve Tegdal Halvorsen Ingebjorg.Halvorsen@usn.no. If you have questions regarding the processing of your personal data you may also contact the USN Data Protection Officer using personvernombud@usn.no .You have all the rights specified in the GDRP: right of access, right of rectification, rights of erasure, right of restriction of processing and/or right to object. If you believe the processing in any way violates your privacy you have the right to complaint to the independent supervisory authority, Datatilsynet.